Bug 171071

iDEFENSE has reported a buffer overflow in the gdk-pixbuf's XPM processor.
(Text taken from the iDEFENSE advisory)

II. DESCRIPTION

Remote exploitation of heap overflow vulnerability in various vendors'
implementations of the GTK+ gdk-pixbuf XPM image rendering library could
allow for arbitrary code execution. iDEFENSE is currently unaware of
exploits for this vulnerability other than those maintainted by iDEFENSE
Labs, however exploitation is trivial. Vendor patches for this iDEFENSE
exclusive report are currently unavailable. A workaround has been
provided.

The vulnerability specifically exists due to an integer overflow while
processing XPM files. The following code snippet illustrates the
vulnerability:

if (n_col <= 0 || n_col >= G_MAXINT / (cpp + 1)) {
                g_set_error (error,
                             GDK_PIXBUF_ERROR,
                             GDK_PIXBUF_ERROR_CORRUPT_IMAGE,
                             _("XPM file has invalid number of colors"));
        return NULL;
    }
[...]
colors = (XPMColor *) g_try_malloc ((sizeof (XPMColor) * n_col));
[...]


The validity check of n_col is enough to prevent an integer overflow in
the first g_try_malloc, however there is not a proper check for the
second g_try_malloc, which allows an undersized heap buffer to be
allocated, then overflowed while using n_col as an upper bounds in a
copying loop. This can be used to execute arbitrary code via traditional
heap overflow 4 byte write methods or by overwriting adjacent areas of
the heap with important values such as function pointers.